THM Evading Logging and Monitoring all task and flags
Please subscribe
Linkedin
/ danny-lopez-617b4011b
exploit tracing aka ETW Event Tracing for Windows
Administrator
Tryhackme!
Take down ETW
ETW instrumentation, ETW evasion, and other ETW-based solutions.
Task 2
Controllers
4726
Task 3
3
104
Task 4
Provider is the assets and the event is traced and sent to a controller or consumer aka event view. The logs are stored locally in Log Files
Task 5
We overwrite the ETW with a null value which will disable ETW
PSEtwLogProvider
m_enabled
Task 6
The stuggle is real for this one
779f245b
c21400
Task 7
2 the two mentioned
4104
Task 8
4103, 4104
EnableScriptBlockLogging
Task 9
module logging
Microsoft.PowerShell.Utility
Task 10
run gpo script
Remove-EventLog c:Microsoft/Windows/PowerShell/Operational
THM{51l3n7_l1k3_4_5n4k3}